Enforce absolute Wasm invocation deadlines

docs/wasm-runtime-architecture.md

@@ -200,11 +200,16 @@ The graceful signal handler belongs to the parent and render workers. Generic
 `task()` children restore default termination signals after fork so
 `task_kill()` and `server_stop()` retain their immediate stop contract.
 
-Epoch interruption measures uninterrupted guest CPU segments. The common
-hostcall membrane re-arms the store deadline after every native call, excluding
-blocking I/O, process waits, hashing, and other host work without weakening a
-guest loop that makes no hostcalls. Keeping this at the membrane also covers new
-hostcalls without per-import timeout bookkeeping.
+Epoch interruption measures uninterrupted guest CPU segments. A separate
+absolute workspace invocation deadline starts before app-owned entry-unit
+loading and initialization and remains unchanged through the selected handler,
+ONCE, and every nested component/unit call. The common hostcall membrane checks
+that deadline before and after every native call and re-arms the store with the
+smaller of the remaining absolute budget and the CPU-segment budget. A cheap
+hostcall loop therefore cannot renew an invocation indefinitely. Blocking host
+helpers retain operation-specific limits and cap them to the remaining
+invocation budget where the underlying operation is cancellable. Forked task
+callbacks receive a fresh invocation deadline capped by the task lifetime.
 
 `request_perf()` reports worker module-cache hits and misses and divides a miss
 into artifact lookup, wasm read, custom-section parse, serialized-module
@@ -506,6 +511,9 @@ header free-functions are `inline`. The wasm backend exposes only declarations
 | Key | Default | Meaning |
 |---|---|---|
 | `WASM_BACKEND_VERBOSE` | `0` | Emit `X-UCE-Wasm-*` workspace timing headers (benchmark only). |
+| `WASM_EPOCH_DEADLINE_TICKS` | `200` | Maximum uninterrupted guest CPU segment in epoch ticks; must be positive. |
+| `WASM_EPOCH_PERIOD_MS` | `50` | Worker epoch-ticker period and timeout resolution; range `1`–`1000` ms. |
+| `WASM_INVOCATION_TIMEOUT_MS` | `30000` | Absolute app-owned unit load/init/handler/nested-call deadline; range `1`–`86400000` ms and nested calls cannot renew it. |
 | `FCGI_SOCKET_PATH` | runtime-configured (`/run/uce/fastcgi.sock` in this doc) | Worker pool FastCGI socket (brokers forward here). |
 | `CLI_SOCKET_PATH` | `/run/uce/cli.sock` | Worker CLI/admin socket. Keep private; reference `CLI_SOCKET_MODE` is `0600`. |
 | `FCGI_SOCKET_MODE` | `0666` | Permission mode applied to `FCGI_SOCKET_PATH` after bind; set tighter if nginx/Apache can use a trusted group. |